How to Check a Website Before Letting an Agent Interact With It

Why This Step Matters More Than It Sounds

An AI agent that can browse the web and take actions — filling forms, clicking through checkout, reading and summarizing a page — is reading everything on that page as potential instruction, not just as content for you. That distinction is the entire basis of prompt injection: a malicious or compromised page can contain hidden text, invisible to a human visitor, specifically written to redirect the agent's behavior once it's read. A human skimming the same page would never notice; an agent parsing the full page text is exposed to it directly.

This isn't a hypothetical edge case. It's a documented, actively studied failure mode for browser-capable agents, and it's the reason a quick check before letting an agent loose on an unfamiliar site is worth the extra minute.

A Practical Pre-Flight List

Why This Can't Be Fully Automated Away

Platforms building browser-capable agents are actively working on defenses — treating page content as data rather than instructions, flagging suspicious patterns automatically — but none of this is airtight yet, and the arms race between injection techniques and defenses is ongoing. Treating every new, unfamiliar site as untrusted by default, rather than assuming the platform's safeguards will always catch a novel attack, is the more durable posture until this problem is genuinely solved.

Building the Habit

Most of this doesn't require special tools — it's a change in how you set up an agent's task. Instead of "go buy this from whichever site has the best price," which sends the agent to unfamiliar domains on its own judgment, specify the exact site you already trust. Instead of granting blanket permission to click through a checkout flow, ask for a read-only summary first, then a second explicit request to complete the purchase. The extra step costs a few seconds and closes off the most common way an agent gets manipulated by a page it visits.

Where This Discipline Matters Most

Where People Underestimate This Risk

The most common mistake is assuming that because a site looks legitimate to a human eye, it's automatically safe for an agent to interact with. Prompt injection content is specifically designed to be invisible or unremarkable to a human visitor — hidden in white text on a white background, tucked into an HTML attribute, or disguised as an innocuous comment — while still being fully readable by an agent parsing the page's underlying content. A page passing a human visual check tells you very little about whether it's safe for an agent to read and act on.

A second issue is granting an agent broad, standing permission to browse and act freely across the web, rather than scoping each session to a specific, bounded task. The wider an agent's latitude to visit unknown pages on its own initiative, the more exposure it has to encountering manipulated content, simply because it's visiting more unvetted pages overall.

It's also worth remembering that this risk compounds with autonomy. A single-step task where you review the result before anything happens is fairly low-risk even on an unfamiliar site; a long, unattended multi-step task that visits several pages and takes several actions without checking back in gives a single bad page far more opportunity to redirect the entire chain of behavior before anyone notices.

This Is a Moving Target

Prompt injection techniques and the defenses against them are both evolving quickly, which means specific advice about what to look for will keep shifting even as the underlying principle — treat page content as untrusted input, not instruction — stays constant. Following how the major AI platforms describe their own defenses against this, rather than relying on a fixed checklist that might become outdated, is worth doing periodically for anyone relying heavily on browser-capable agents.

It's also worth treating any agent's report of what it found on a page with a bit of healthy skepticism, especially for anything genuinely consequential. If an agent's summary of a page seems to include an oddly specific instruction or request that wasn't part of your original task, that's a strong signal worth investigating rather than dismissing, since it's exactly the kind of anomaly a successful injection attempt would produce.

Keep a Record of Flagged Incidents

If an agent ever does encounter something that looks like an injection attempt, keeping a simple record of what happened and which site triggered it is worth doing even informally, since patterns across incidents over time can reveal whether certain categories of site are consistently riskier for your specific use case than others. That record also becomes useful context to share if you ever report the issue to the platform running the agent, since a specific, reproducible example is far more actionable than a general description of a concern.

Common Questions